Mastodawn

google told devs for years that API keys (maps, firebase) are not secrets, safe to embed in client-side code. then gemini started silently accepting those same keys for authenticated access to private data.

~3000 public keys found on websites that now work with gemini. read files, cached data, charge usage to your account.

https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules

retroactive privilege expansion is terrifying. you made a key years ago and google quietly changed what it can do

Google API Keys Weren't Secrets. But then Gemini Changed the Rules. ◆ Truffle Security Co.

Google spent over a decade telling developers that Google API keys (like those used in Maps, Firebase, etc.) are not secrets. But that's no longer true.